4 July 2020

STANAG-4481F from NSY, back to normal op

(for background read all the post of this topic
After a period during which the signals showed a strange behavior consisting of a 3-bit period (which in some way "simulated" a 50Bd speed), it seems that the transmissions from NSY Niscemi have back to normal 75Bd operations. So far, I checked almost all the channels except 8145.0 and 8204.5 KHz (and 13229.0 Khz but from NAU Isabela).

Fig. 1 -  6732 KHz from NSY Niscemi in different dates
There is however a peculiarity that is noteworthy: according to my logs and analysis NSY is the only station that uses KW-46 encryption - instead of KG-84 - with the 4481F 75Bd waveform(!), the other stations that use that encryption all adopt the 50Bd waveform. This fact modifies the content of a previous post according to the following diagrams (although provisional).

Fig. 2 - 6732 KHz streams from NSY Niscemi in different dates
Fig. 3
https://yadi.sk/d/02FOSxK157CsYw

3 July 2020

50Bd/300 async 5N1.5 FSK (likely Serbian-Mil)

6374.8 KHz (cf) async 50Bd/300 FSK using 5N1.5 framing, after demodulation:
UFBV UFBV UFBV de FNCS FNCS FNCS
E9U9 E9U9 E9U9 de FNCS FNCS FNCS
Z64G Z64G Z64G de FNCS FNCS FNCS

Friends from UDXF group suggest Serbian Army as the user.



https://yadi.sk/d/SblPr4eOCLpR4Q

30 June 2020

CIS-75 FSK 75Bd/250 (3): 126-bit LFSR sequence

(for background, read all the posts of this topic)
Russ-Mil CIS-75 75Bd/250 FSK system spotted this morning on 15832.0 KHz (cf). After differential decoding, the bitstream shows a clear 385-bit period and a 126-bit pseudo random sequence, generated by the polynomial x^7+x^6+1, which is inserted in the data stream probably to re-sync the receive modem among the messages:

111110111110011110101110000110111010011000101011000001011110001
110110110010010100100001001110010110100010001100110101010000000

Fig. 1 - 126-bit pseudorandom sequences
Fig.2 - the synched stream
It's interesting to note that in previous CIS-75 recordings, we saw the use of a 128-bit (!) length pseudo-random sequence transmitted in positive and negative polarity: those sequences are easily identifiable by inspecting the stream with a window, coincidentally, 385-bit wide.
By the way, the same polynomial x^7+x^6+1 is also used by the French-Ny in their 50Bd/850 FSK fleet broadcast as one of the two stream LFSR delimiters [1].  


29 June 2020

unid 40.4Bd/800 FSK & FSK/Morse

6800.0 KHz (cf): unusual 40.4Bd/800 FSK long time reversals then into FSK/Morse "UUG4 de UTN7 ZC GB 73 SK" and off-air. Most likely a CIS network.
 
 
Comments are welcome 😄

23 June 2020

CIS Navy 50Bd/500 FSK 136 bit (T600-136)

Yet another 50Bd/500 FSK transmission, this time recorded monday morning on 14704.0 KHz (cf) around 1340Z and almost surely sourced by the CIS Navy T600 system (typical shifts: 200, 250, and 500 Hz): given the 136-bit length frames this waveform is also known as "T600-136".

Fig. 1 - FSK parameters
Note that the full transmission period is 544-bit length, i.e. 4 x 136-bit frames. Indeed, from a quick examination of the demodulated bitstream (Fig. 2), it is easy to see that it's composed of blocks of four repeated frames, probably to add redundancy to the system.

Fig. 2 - CIS-Ny 50Bd/500 bitstream (136-bit frames)
The same 136-bit framing is also used in the CIS-Ny 50Bd/250 FSK, still from a T600 system (Fig. 3): these two waveforms seem to be used to carry the same "type" of messages unlike the CIS-Ny 50Bd/200 FSK which shows a different structure of the frames (70-bit Message Indicator, 4:3 ratio,...) and it's mainly used for fleet broadcast.

Fig. 3 - CIS-Ny 50Bd/250 bitstream (136-bit frames)

Although the shift is a multiple of the manipulation speed, the two tones do not preserve their phase (Fig. 4).

Fig. 4 - CIS-Ny 50Bd/500 tones

14 June 2020

50Bd/500 FSK (likely CIS Gov/Mil)

update

My friend cryptomaster (thanks) confirmed the user (CIS networks) and he also pointed out that the 128-bit sequence is actually a 64-bit sequence that is transmitted in opposite polarity:
1111101111001110101100001011100011011010010001001100101010000001
0000010000110001010011110100011100100101101110110011010101111110


As well as the central part of the message which is the same 64-bit sequence (here 13-bit shifted) but with one bit in error:
0010101000000111110111100111010110000101110001101101001000100110
1101010111111000001000011000101001111010001110010010110111011000



11 June 2020

Unid (likely CIS) 50Bd/500 FSK message recorded on 12221 KHz (cf) at 1035z using the KiwiSDR "nsk" located near Novosibirsk, Russia. Notice the LFSR sequences generated by the polynomials x^7 + x^5 +x + 1 (128 bytes length) and x^5 + x^4 + x + 1 (Fig. 1).

Fig. 1 - the two LFSR sequences
Although the shift is an integer multiple of the speed, the two FSK tones do not preserve their phases (Fig. 2).

Fig. 2 - phases of the two FSK tones
https://yadi.sk/d/mZiO7oRcHtQ5-Q

5 June 2020

Saab Grintek MHF-50 "preamble" variant

6 June 2020 update


As noted by my friend KarapuZ, the 75Bd/170 FSK segment 
010100101001010010100101001010010100101001010010100101001010010100101
can be successfully descrambled using the polynomial x^8 + x^6 + x + 1; maybe it serves sync purposes for the following MFSK decoder. It's interesting to note that the same polynomial is used in CIS-75 waveform.



It's supposed that some frequencies (4346, 6504, 8580, 12982, ...) are either channel markers, propagation markers and/or FAB channels and some other (4245, 6407, 6493, 8603, ...) are traffic channels; anyway, it seems that they carry different patterns.



5 June 2020


Saab Grintek MHF-50 variant recorded on 8603.0 KHz/USB using the KiwiSDR located at TWR Kempton Park, South Africa: notice that 8603.0 Khz is believed to be one of working channels used by South African Navy.
The signal has a kind of "preamble" (Figs. 1,2) which is followed by the usual multimode waveform. This preamble consists of a short 75Bd/170 FSK
010100101001010010100101001010010100101001010010100101001010010100101
followed by a 120 sec long 1622 Hz tone which exhibits interesting markers each 12 & 1 seconds maybe to serve sync purposes.

Fig.1
Fig.2
As said, the preamble is followed by the well known multimode waveform (Figs. 3,4) consisting of 54.4Bd/390 FSK and 54.4Bd/65 MFSK-33 with the characteristic 3 tones signaling the EOM.

3 June 2020

NATO 75Bd & 50Bd FSK: F1F2 phase

I decided to replicate the analysis of the phase of the two FSK tones shown in the  previous post  by taking a look at the NATO 75Bd & 50Bd FSK transmissions just because only in the latter the shift (850 Hz) is an integer multiple of the bit rate (850/50 = 17). The The difference between manipulation with a break and without a phase break during switch-over is also visible in SA program in Wave Form mode (Fig. 1): signal "a" is 75Bd/850 FSK, signal "b" is 50Bd/850 FSK; all NATO transmissions.

Fig. 1 -
As expected, both the tones of the signal a (75Bd/850 FSK) do not preserve their phase after each switch-over (Fig. 2) while the tones of signal b (75Bd/850 FSK) preserve their phase (Fig. 3).

Fig . 2 - 75Bd/850 FSK
Fig. 3 - 50Bd/850 FSK
To be precise, 75Bd FSK is from NAU Isabela on 16121 KHz and 50Bd FSK is from NSY Niscemi on 8203 Khz: therefore it must be considered that generally the data are not generated in the same place where the FSK signal is formed. Don't know if the same modem is used in both the waveforms (...and in both the two TX sites), anyway the two tones of the French-Ny 50Bd FSK too have the same behavior i.e their phase is preserved (Fig. 4).

Fig. 4 - French-Ny 50Bd/850 FSK

2 June 2020

200Bd/1000 FSK Rus-Intel 288-bit (F06x)

200Bd/1000 FSK Rus-Intel 288-bit (aka Enigma F06x) transfers with a slightly different pattern, although all recognized by Rivet [1]. Each frame starts with a 32-bit (4 bytes) sync sequence 0x7D12B0E6
10111110010010000000110101100111
followed by a 11-bit frame line counter (block index). The sync sequence could be generated by the polynomial x^5 + x^4 + x^3 + X + 1.
More and accurate details here.

27 May 2020

unid 200Bd/800 FSK (2)

(see the previous post for background)
My friend cryptomaster suggested me an interesting way to measure and analyze the two component frequencies of the 200Bd/800 FSK signal by using the VMW module of SA. Indeed, using that tool it is quite possible to obtain additional phase characteristics of the signals. For this, it is necessary to consider the bitmap picture of the carrier signal, adjusting the scan so that one period of the carrier wave fits on the line of the raster. Two columns of red and blue colors  on the screen of the WMV module reflect the positive and negative half-cycles of the oscillation (Fig. 1).

Fig. 1 - oscillation period (thanks to cryptomaster)
Well, it turned out that during the formation of this FSK signal the pahses of the two frequencies are preserved after each "shift" (Figs 2a,2b): that suggests that it's formed by switching (mechanically or electronically) two independent F1 F2 frequency generators which bear some inter-relationships or by using a VCO system.

Fig. 2a - F1 component phase (on a 2 periods view)
Fig. 2b - F2 component phase (on a 3 periods view)
Phase analysis was performed on a signal recorded in IQ mode exactly on its center fequency of 5094.7 KHz: in this case the two values of the frequency generators are:

F1 ~ 5602,6 HZ (2:0,000356972)
F2 ~ 6402,6 Hz (3:0,000468558) 

as expecetd, 800 Hz shift.
Me and cryptomaster discussed these values and he obtained an interesting result recording the signal at a frequency of 5093.50 KHz/usb. In this case, the carriers are equal to F1 = 800Hz F2 = 1600 Hz (Fig. 3).
 
Fig. 3 - F1 F2 components (thanks to cryptomaster)
Probably the lower frequency is obtained using a d
ivide-by-2 circuit. Anyway, examining the signal at different intervals, one can notice a small discrepancy in the phases of these two frequencies (Fig. 4): thus, it is once again proved that the signal is generated by two different generators.

Fig. 4 - discrepancy between F1 F2